GNU cpio -O archive option insecure permissions
| cpio-o-archive-insecure-permissions (19167) |  Medium Risk |
Description:
GNU cpio creates files with mode 0666 (world readable and writable) permissions when the -O archive option is used. A local attacker could use this vulnerability to view or overwrite arbitrary files on the system.
Consequences:
File Manipulation
Remedy:
For FreeBSD:
Reportedly, this vulnerability is fixed in version 1.3 of cpio/main.c. Refer to the FreeBSD Web site for more information. See References.
For Ubuntu Linux:
Refer to USN-75-1 for patch, upgrade, or suggested workaround information. See References.
For Debian GNU/Linux 3.0(woody):
Upgrade to the latest version of cpio (2.4.2-39woody1 or later), as listed in DSA-664-1. See References.
For Conectiva Linux 10.0:
Upgrade to the latest version of cpio, as listed in Conectiva Linux Security Announcement CLSA-2005:1002. See References.
For Red Hat Linux:
Refer to RHSA-2005:073-07, RHSA-2005:080-06, RHSA-2005:806-8 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- Conectiva Linux Security Announcement CLSA-2005:1002: Fixes for cpio vulnerabilities.
- Cpio Web page: Cpio.
- FreeBSD Web site: cpio -O ignores umask.
- BID-12404: CPIO Archiver Local Insecure File Creation Vulnerability
- CVE-1999-1572: cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- DSA-664: cpio -- broken file permissions
- MDKSA-2005:032: Updated cpio packages fix vulnerability
- MDKSA-2005:032-1: Updated cpio packages fix vulnerability
- RHSA-2005-073: cpio security update
- RHSA-2005-080: cpio security update
- RHSA-2005-806: cpio security update
- SA17063: Avaya Products cpio Insecure File Creation Vulnerability
Platforms Affected:
- Canonical Ubuntu 4.10
- Conectiva Linux 10
- Debian Debian Linux 3.0
- FreeBSD FreeBSD 2.1.0
- GNU cpio
- MandrakeSoft Mandrake Linux 10.0
- MandrakeSoft Mandrake Linux 10.0 AMD64
- MandrakeSoft Mandrake Linux 10.1
- MandrakeSoft Mandrake Linux 10.1 X86_64
- MandrakeSoft Mandrake Linux 9.2 AMD64
- MandrakeSoft Mandrake Linux 9.2
- MandrakeSoft Mandrake Linux Corporate Server 2.1
- MandrakeSoft Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft Mandrake Linux Corporate Server 3.0
- RedHat Enterprise Linux 2.1 ES
- RedHat Enterprise Linux 2.1 WS
- RedHat Enterprise Linux 2.1 AS
- RedHat Enterprise Linux 3 AS
- RedHat Enterprise Linux 3 Desktop
- RedHat Enterprise Linux 3 ES
- RedHat Enterprise Linux 3 WS
- RedHat Enterprise Linux 4 AS
- RedHat Enterprise Linux 4 ES
- RedHat Enterprise Linux 4 WS
- RedHat Enterprise Linux 4 Desktop
- RedHat Linux Advanced Workstation 2.1 Itanium
- Turbolinux Turbolinux 10 Server
Reported:
Jul 16, 1996
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net